I am trying to allow ldap users to change their password on client machines. I have tried pam every which way I can think of
/etc/pam_ldap.conf, as well. At this point I'm stuck.
Client: Ubuntu 11.04
Server: Debian 6.0
The current output is this:
sobrien4@T-E700F-1:~$ passwd passwd: Authentication service cannot retrieve authentication info passwd: password unchanged
/var/log/auth.log gives this during the command:
May 9 10:49:06 T-E700F-1 passwd: pam_unix(passwd:chauthtok): user "sobrien4" does not exist in /etc/passwd May 9 10:49:06 T-E700F-1 passwd: pam_ldap: ldap_simple_bind Can't contact LDAP server May 9 10:49:06 T-E700F-1 passwd: pam_ldap: reconnecting to LDAP server... May 9 10:49:06 T-E700F-1 passwd: pam_ldap: ldap_simple_bind Can't contact LDAP server
getent passwd |grep sobrien4 (note keeping short since testing with that account, however it outputs all ldap users):
getent group shows all ldap groups.
/etc/pam.d/common-password (Note this is just the most current, I have tried a lot of different options):
password required pam_cracklib.so retry=3 minlen=8 difok=3 password [success=1 default=ignore] pam_unix.so use_authtok md5 password required pam_ldap.so use_authtok password required pam_permit.so
Popped open wireshark as well, the server & client are talking.
I have the password changing working on the server. I.E. the server that runs slapd, I can log in with the ldap user and change the passwords. I tried copying the working configs from the server initially and no dice.
I also tried cloning it, and just changing ip & host, and no go. My guess is that the client is not authorized by ip or hostname to change a pass.
Pertaining to the slapd conf, I saw this in a guide and tried it:
access to attrs=loginShell,gecos by dn="cn=admin,dc=cengineering,dc=etb" write by self write by * read access to * by dn="cn=admin,dc=cengineering,dc=etb" write by self write by * read
So ldap seems to be working okay, just can't change the password.